Allow auth adapters to signal that the email address they're returning is trusted, so the email verification step can be skipped
AbandonedPublic
Actions

Authored by talshiri on May 15 2014, 9:31 PM.

Details

Reviewers

Group Reviewers

Summary

The Google OAuth provider returns trusted emails (they are how the account is identified), which allows us to skip the email verification step. This is nice when you're trying to onboard an entire office to Phabricator :)

A second patch will follow shortly (in the phabricator repo)

Test Plan

tested locally

Diff Detail

Repository

rPHU libphutil

Branch

master

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 495
Build 495: [Placeholder Plan] Wait for 30 Seconds

Event Timeline

talshiri updated this revision to Diff 21713.May 15 2014, 9:31 PM

talshiri retitled this revision from to Allow auth adapters to signal that the email address they're returning is trusted, so the email verification step can be skipped.

talshiri updated this object.

talshiri edited the test plan for this revision. (Show Details)

talshiri added a reviewer: epriestley.

Herald added a reviewer: Blessed Reviewers. · View Herald TranscriptMay 15 2014, 9:31 PM

Herald added subscribers: Korvin, epriestley. · View Herald Transcript

Harbormaster completed remote builds in B495: Diff 21713.May 15 2014, 9:32 PM

I don't want Phabricator to implicitly trust Google or any other provider.

I'll accept a version of this patch which makes this configurable from the web UI.

This revision now requires changes to proceed.May 15 2014, 9:41 PM

Are emails coming from Google ever not trusted?
If I make it configurable, would it be ok to make it the default on Google?

I don't want to ever default to trust. Trust allows a possibly-minor vulnerability in a third party system to escalate into a compromise in Phabricator.

Not needed anymore (config stuff live in the phabricator repo)